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Abstract 

We consider the recursive Fourier sampling problem (RFS), and 
show that there exists an interactive proof for RFS with an efficient 
classical verifier and efficient quantum prover. 



1 Introduction 

The Recursive Fourier Sampling (RFS) problem is an oracle based decision 
problem that was proposed by Bernstein and Vazirani in |BV97j . Historically, 
RFS was the first problem that showed a relativized separation between BQP 
and P. 

Along with their definition of RFS, Bernstein and Vazirani also proved 
a lower bound for the classical query complexity and an upper bound for 
the quantum query complexity, establishing the P versus relativized BQP 
separation. Later Aaronson |Aar03| proved matching lower bounds for the 
quantum query complexity of RFS. Johnson |Joh08] extended and improved 
these results, including bounds on the polynomial degree of RFS. Hallgren 
and Harrow [HH08J subsequently generalized the recursive structure of the 
problem to allow a super-polynomial speedup, relative to an oracle, based on 
randomly generated quantum circuits. 
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Bernstein and Vazirani also showed that RFS is not in NP. Aaronson 
|Aar03j claims that the proof can be extended to show that RFS is not in 
MA, and it has been conjectured by Vazirani and others that it is not even 
in PH. This gives an oracle relative to which BQP is not in MA, and hope 
that a relativized separation may be found between BQP and PH. 

In the remainder of this section we recall the definition of the recursive 
Fourier sampling problem and the optimal classical and quantum algorithms. 
Our main contribution is in section 2, where we give an algorithm for an 
interactive proof for RFS and show how the standard quantum algorithm 
for RFS can be adapted to be used as an efficient prover for the interactive 
proof. 

1.1 The recursive Fourier sampling problem 

We begin by defining a type of tree. Let n, I be a positive integers and consider 
a symmetric tree where each node, except the leaves, has 2 n children, and the 
depth is I. Let the root be labeled by (0). The root's children are labelled 
(xi) with x\ G {0,1}™. Each child of {x\) is, in turn, labelled (£i,£2) with 
x 2 G {0, l} n . We continue until we have reached the leaves, which are labelled 
by (xi, . . . , xi). Thus each node's label can be thought of as a path describing 
how to find the node from the root. 

Now we add the Fourier component to tree. We begin by fixing an effi- 
ciently computable function g : {0, 1}™ — > {0, l}Jl| With each node of the tree 
(xi, . . . ,Xk) we associate a "secret" string S( Xli ... ia!fc ) G {0, l} n . These secrets 
are promised to obey 

9 (•-' n , , •) = S {xu ... iX ^ l} ■ X k (1) 

for k > 1, and the inner product taken modulo 2. (Here we take sr xi x^^) 
to mean S(a\ if k = 1.) In this way, each node's secret encodes one bit of 
information about its parent's secret. 

Now suppose that we are given an oracle A : ({0, l} n )' -»■ {0, 1} which 
behaves acl 

A(x h ...,Xl) = g a:,)) • ( 2 ) 

1 For concreteness g(s) may be taken to be the sum of the components of s, modulo 3, 
i.e. the number of Is, or Hamming weight, of s modulo 3. 

2 In fact the values S/ Xlt _ >xi ) are not necessary, since we can only ever learn g(sr xi ^ ^ xi \). 
However, including them in the definition eliminates special cases at the level /. 
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Note that A works for the leaves of the tree only. Our goal is to find g (s(0)) . 
This is the recursive Fourier sampling problem (RFS). 

At this point we wish to discuss the recursive nature of the RFS problem. 
First, note that the subtree rooted at any node obeys the same promises as 
the whole tree. Thus each subtree defines an RFS problem. (The subtree 
rooted at a leaf is a trivial problem, where the oracle just returns the solu- 
tion.) Thus we have a methodology for solving RFS problems: solve subtrees 
in order to determine information about the root's secret, then calculate the 
secret. Solving subtrees uses the same method, except when we reach a 
leaf, where the oracle is used instead. This is a type of top down recursive 
structure, where the tree is built from a number of subtrees with the same 
structure. 

Another way of viewing the tree is from the bottom up. Note that if 
we remove all the leaf nodes, truncating the tree, then the remaining tree 
still obeys all the required promises. The oracle no longer returns relevant 
information, however. This problem can be solved by building a new ora- 
cle using the old one. The new oracle, given (x±, . . . , calculates the 
secret S( Xli ... i - E; _ 1 ) by accessing the old oracle. The new oracle then returns 
<7(s(xi,...,x(_i))- An oracle constructed in this way behaves exactly as the old 
oracle does, but for the truncated tree. The tree can be truncated again to 
depth I — 2 and another new oracle is built on the previous one. The result 
is a recursive algorithm that eventually solves the RFS problem. 

With a little thought, it is easy to see that both pictures of the recursive 
structure of the RFS problem are essentially equivalent. Indeed, solving 
a subtree rooted at (xi, . . . ,Xk) just means returning <7(s(xi,...,x fc ))j which is 
what the oracle for the tree truncated at level k does. However, each picture 
can be useful in understanding the structure of algorithms. 

1.2 Classical solution 

Now let us consider the following solution to the recursive Fourier sampling 
problem in the classical setting. To calculate g («(0)) we must first find s^y 
To do so, let us define lj to be the n-bit string with a 1 in the jth position 
and elsewhere. Define (s(0))j to be the jth bit of S(0), which is given by 
S(0) • lj. These values are given by the solution to the RFS problem defined on 
the subtree rooted at (xi) with x\ = lj. After determining these values for 
j = 1 ... n we have determined S($y Hence we obtain the following algorithm: 
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Algorithm 1 (RFS). Input: oracle A, subroutine g, l,k, (x\, . . . ,X}~) 

1. If k = I then return A(x\, . . . , x{) 

2. For j — 1 . . . n 

(a) Set (s) j = RFS(A,g,l, k + 1, (x 1} ...,x k , L,)) 

3. Return g(s) 

Lemma 1. RFS(A, g, I, 0, ()) returns g(s^)). 

Proof. We proceed by induction. We claim that for < k < I 

RFS(A, g, I, k, (xi, . . . , x k )) = g(s {xu ..., Xk) ). (3) 

For k = I this is true by the definition of the oracle. 

Now suppose that < k < I. By induction, step (a) sets (s)j = 

9 {*:.,-. ,-,.:,:•) which is promised to equal s^,...,^) • lj- Thus s = S( Xl> „. }Xk ) 

and the function returns g(s( Xl! _ !Xk )), as claimed. Calling RFS(A, g,l,0, ()) 
then returns g (s(0))- 

□ 

The query complexity of this algorithm is n l , which can be seen since 
each call to RFS calls itself n times, and the depth of recursion is /. 

This solution is due to Bernstein and Vazirani |BV97] , who also gave a 
matching lower bound on the number of queries, so the query complexity is 
Q(n l ). 

1.3 Quantum solution 

We now consider the analogous quantum problem, where the oracle A allows 
quantum access according to 

A\x 1 )...\xi)\y)= | x x ) . . . | xi) | y © g(s {xu ... :Xl) )) . (4) 

In addition, we have an efficient quantum algorithm which calculates g as 

G\s)\y) = \s)\y®g(s)) . (5) 

The main idea behind the algorithm is to use the fact that H® n transforms 
| y) into J2 x (~^) x y \ x ) an d y i ce versa. We use phase feedback and a call 
to A to create the state l) S(xi '- ■■• x i-iy x ' \ x), then apply H® n to obtain 

| s^,...,^)). After calculating g{s{x u ... )Xl _ 1 )), we uncompute | s^,...,^)) to 
disentangle this register from other registers. 
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Algorithm 2 (QRFS). Input: oracle A, subroutine Gj, I, k, quantum reg- 
isters Xi, . . . , x k , y . 

1. If k = l then apply A to {X\ . . . X\) and y, then return. 

2. Introduce ancilla X k+1 in the state -j= J2 Xk+1 e{o,i} n I x k+i)x k+1 - 

3. Introduce ancilla y' in state ^ (| 0) yi — \ l)y,) ■ 

4. Call QRFS(A, G,l,k+ 1, (X 1 . . . X k+1 ), y') 

5. Apply H® n on register X k +\. 

6. Apply G to X k +i and y . 

7. Apply H® n on register X k +i . 

8. Call QRFS(A, G,l,k+ 1, (X 1 . . . X k+1 ), y') 

9. Discard X k +i and y' . 
10. Return 

Lemma 2. QRFS(A, G, I, 0, (), | 0)) returns \g(s@))). 

Proof. To analyze the correctness of the algorithm we proceed by induction 
with the hypothesis that for each < k < I, QRFS (A, G, I, k, {X x . . . X k ), y) 
applied to | X\) . . . \ x k ) \ y) gives 

\xi) . . .\x k )\y ® g (s {xit ... tXk) )) . (6) 

(The output for general input states is determined by linearity.) This is true 
for k = I by definition of the oracle. 

Now let < k < I. We introduce the state ^ (| 0) — | 1)) in step 3 in 
order to use phase kickback. By hypothesis, then, step 4 introduces phase 
of (-l) 9(s (-i- ->*k+i)\ which is the same as (-l) 3 ^- ■■■,* k r Xk + 1 . The state after 
step 4 is thus 

_L | Xl) . . . | Xk + l) | y) | _) . (7) 

After step 5 the state then becomes 

\x ± ) ...\x k )\s {xu ^ Xk) )\y)\-) . (8) 
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Step 6 changes \y) to | y © g (s^,...,^)) ). Next, steps 7 and 8 uncompute 
the Xk + i register, so it and the y' register are returned to their original state 
when they are discarded in step 9. Thus we obtain the required output state. 

From the inductive hypothesis, we see that QRFS(A,G,l,0, (),y) ap- 
plied to | 0) gives | g (s(0)))- □ 

Note that if we apply QRFS(A, G, I, k, {X\ . . . Xk), y) to | x\) . . . | Xk) \ y), 
and stop after step 5, we obtain | s^,...^*)) i n the Xk+i register. This is 
equivalent to solving the RFS problem defined by the subtree rooted at 
(xi, . . . ,Xk). Thus we can also efficiently calculate any S( xl) ... )Xfc ). 

This algorithm is due to Bernstein and Vazirani |BV97j . The quantum 
query complexity of this algorithm is 0(2'), since two recursive calls are 
made, and the depth is I. Aaronson |Aar03] gave a matching lower bound. 

1.4 Complexity implications 

In the previous sections we have kept both n, the size of the bit strings, 
and I, the depth of the tree. Typically, RFS is considered with I = log 2 n. 
In this case we obtain query complexities of O(n log2n ) classically, and 0(n) 
quantumly. Hence we obtain the relativized separation of BQP ^ P. It is 
also for this value of / that RFS ^ MA. 

2 Interactive proof 

Suppose now that we have, in addition to the oracle A and classical com- 
puting resources, access to a prover P who has more powerful computing 
resources. We have seen that for the choice / = log 2 n there is no way of 
efficiently computing the solution to the recursive Fourier sampling problem 
directly. In fact, since RFS is not in NP, we cannot even efficiently verify a 
solution if it is given (along with a short proof.) We will show, however, that 
by interacting with P we can efficiently compute the solution, or detect if P 
is giving false information. That is, RFS is in IP. 

It is not surprising that RFS is in IP, indeed BQP C IP in the unrelativized 
world. However, IP is defined with an computationally unbounded prover, 
and here we will see that for RFS it suffices to have an efficient quantum 
prover. 
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2.1 Classical verifier 

Looking back at the original classical solution to RFS in Algorithm [TJ we 
see that there are two steps: find st Xl; _ )Xh ) and calculate g(s/ Xu ___ )Xk \). The 
difficult part is finding st Xl; ___ )Xh ), so we can instead ask P to do this for us. 
Since we do not trust P, we should perform some type of test to see whether 
P has really given us the correct value of sr Xl) _ )Xh \. 

Suppose that P gives us a string s', Xi s. In principle we can detect 
the case s'^ ^ ^ S( Xl) ... iXk ) by instead looking at whether s' {xu ^ Xk) ■ x k+1 = 
s {x u ...,x k ) ■ Xk+i for a randomly chosen x k +i G {0, 1}™. If s'^i,...,^) ^ s^,...,^) 
then s' {xu ^ Xk) ■ x k+ i ^ s^,...,^) ■ x k+1 for half of all strings x k+1 G {0, l} n . If 
we check for c independently chosen strings x k+ \ then we will fail to detect 
P's deception with probability 2~ c . 

Since we have s', „ we can calculate s', „ s • x k +i readily, but how 
do we find S(x u ... )Xk ) ' x k+i^ We use recursion: we ask P for S( xl) ... jXfc+1 ) and 
again perform the test. After the recursion is deep enough, we can query the 
oracle directly to find S( Xl ,...,xi-i) ■ x l — A(xi, . . . , x{). 

Algorithm 3 (VERIFIER). Input: Oracle A, ProverP, subroutine g, total 
number of levels I, current level k, queries (xi, . . . x k ). 

1. If k = I then return A(x\, . . . , x{) 

2. Query P for s[ Xi ^ Xk) 

3. Repeat 3 times: 

(a) Randomly choose x k+ i G {0, l} n 

(b) Set a = VERIFIERS, P, g, I, k + 1, (x ls . . . , x k+1 )) 

(c) If ) ■ x k+x then abort 

4- Return g{s' XJ „ ) 

We must also specify what the behaviour of P should be. When P receives 
a query (x%, . . . , x k ), it should return a string s', j x s G {0, l} n . For an 
honest P this should be equal to S( xl> _ )Xh y 

Clearly there exists a prover P which always returns S( X1 Xk \ when queried: 
P can solve a subtree of the full RFS problem, rooted at (xi, . . . , x k ) to find 
S{ Xl ,...,x k )- For such a prover, we may perform VERIFIER(A, P, g, I, 0, ()) to 
obtain g (s(0)), which is the answer to the RFS problem. 
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Lemma 3. Let P be a prover that always returns s', s = S( xlv .. )Xfc ) when 
queried. Then 

VERIFIER(A,P,g,l,0,()) = g(s m ). (9) 

Proof. We proceed via induction, as in previous proofs. We claim that for 
< k < I 

VERIFIER^, P, g, I, k, (x ± , x k )) = g{s {xi _ Xk) ). (10) 

This is true for k = I from the definition of the problem and line 1. For k < I 
we see from line 4 that the claim holds for this choice of P so long as the 
algorithm does not abort in line (c). 

Now suppose that < k < I. By induction, step (b) sets a = <?(s( Xl) ... iXfc )) 
s (x 1 ,...,x k _ 1 ) ' by the definition of the problem. Again, by the choice of P 
this is always equal to s'^ Xi Xk _^ ■ Xk and the algorithm never aborts. 

□ 

Our next concern is what the algorithm does when interacting with a 
prover P that is not return correct strings. The next lemma says that the 
algorithm returns an incorrect result with low probability; the rest of the 
time the algorithm aborts. Hence we are protected from a malicious P. 

Lemma 4. For any P, the probability that VERIFIER(A, P, g,l,0, ()) does 
not abort and returns a value not equal to g(s(0)) is at most |. 

Proof. Let pu, < k < I be the probability that VERIFIER does not abort 
and returns a value that is not equal to <7(s(xi,...,fc fc ))- To be precise, we should 
specify what P does, since pu can depend on P's behaviour. Let us then take 
the maximal pk over all choices of P, which will give us an upper bound for 
any particular P. 

We proceed by induction with the hypothesis that p k < 1/4. For k = I 
this true since A(x ± , ...x t )= g{s^ Xu ..^ Xl) ) so p x = 0. 

Now suppose that < k < I. There are two cases. First, P returns 

s (xi,...,x fc ) sucn tliat 0( s (xi,...,k fc )) = 9( s (x!,...,k k ))- In this case VERIFIER al- 
ways returns the correct value, so pk = 0. Note that VERIFIER may still 
abort, since s'^ xi x ^ may not equal S( xl) ... )Xfc ), or the recursion may return an 
incorrect result. 

Now consider the case where P returns some s', „ n such that q(s', „ 

(xi,...x fc ) v\ (xi,...x fc )/ 

g( s (xi,...x k ))- If the algorithm does not abort in line (c) then one of two things 
happened: either s'^ Xi Xk yXk+i = S( Xlj ... Xfc ) -Xk+i for this choice of Xk+i, which 
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happens with probability |, or s'^,...^) ■ x k+ i ^ S( xu ... Xk ) ■ x k+1 and at the 
same time the recursion in (b) returns an incorrect value. The latter two 
events occur together with probability at most ^ tl . Thus, for each of the 
three repetitions, the probability of not aborting is at most |(1 + Pk+i) and 
the overall chance of not aborting is 

p k <^(l+Pk + i) 3 - (11) 
By the induction hypothesis, Pk+i < \- Then 

Pi <i( 1+ iy = ^<i. (12) 

y 8 V 4/ 512 ~ 4 v ; 

Using induction, we obtain the result for < k < I. In particular, p < 1/4, 
which is the desired result. 

□ 

Corollary 1. VERIFIER(A, P, g,l,0, ()) solves the recursive Fourier sam- 
pling problem with completeness 1 and soundness 1/4. 

The algorithm uses 3 l queries to the oracle and fewer than 3 l to the prover. 
With the choice I = log 2 n this is polynomial in n. 

2.2 Quantum prover 

Although the class IP is usually defined for a computationally unbounded 
prover, it happens that for RFS and the verifier presented above, the prover 
can be an efficient quantum prover. That is, if the prover is quantum then 
it need only make a polynomial number of queries to the oracle. 

As mentioned in section 11.31 algorithm [2] makes at most 2 l queries to 
find S(0) and can be adapted to find s^!,...,^) using at most this number of 
queries. We can thus readily adapt algorithm [2] to create a prover for the 
above classical verifier. The total number queries that the prover will make 
is less than 3 l 2 l < n 2 - 58 . 

3 Discussion 

Recently there has been interest in interactive proofs in a quantum context 
and, most relevant here, interaction between quantum provers and classi- 
cal verifiers. Work in this direction began with Mayers and Yao [M Y04] . 
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and Magniez et al. pV!MMO06] who showed how to classically verify (with 
certain assumptions) the operation of quantum apparatus, including entire 
circuits. Recently, Aharonov et al. [ABOE08J and Broadbent et al. [BFK09J 
considered verifiers with limited quantum capabilities. As well, Broadbent 
et al. demonstrated an interactive protocol, which has the full power of BQP, 
between two entangled, but non- communicating, efficient quantum provers 
and an efficient classical verifier. Ideally we would like to show that that 
every problem in BQP has an interactive proof with a single efficient quan- 
tum prover and a classical verifier (let us call the class of such problems 
IPbqp-) Unfortunately, self-testing and the Broadbent et al. protocol both 
rely fundamentally upon non-local properties of quantum theory, making the 
techniques unsuitable to the single-prover scenario. 

In this context, the current work is interesting because it shows that there 
is an oracle relative to which IP B qp £ MAI Since BQP C PSPACE = IP 
an interactive proof exists for every problem in BQP, but the only known 
construction, due to Shamir [Sha92j . uses a PSPACE prover. The interest for 
the current result, then, is the fact that the interactive proof has an efficient 
quantum prover. 

Another interesting aspect of this work is the fact that the structure of 
the interactive proof is not informed by the structure of the prover but arises 
naturally from the structure of the problem. This is in contrast to results 
in [MMMO06] and [BFK09J, which essentially analyze the quantum provers 
in action to verify correct operation. This may indicate that a different 
methodology from these partial results is necessary, or at least useful, in 
order to reduce the number of provers down to one. 
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